fix bootstrap?
read secrets from env vars if possible